Who counts as a US requester?

When someone selects US as where they live, Blankitt Privacy handles the request under California's CCPA/CPRA: a 45 calendar day deadline, the California request types (know, delete, correct, opt out of sale or sharing, limit use of sensitive information), and a 60 day appeal window with escalation wording that points to the state Attorney General.

Why California?

The United States has no single federal privacy law. Instead there's a patchwork of state laws (California, Virginia, Colorado, Connecticut, Texas, and a growing list), each with slightly different rights, deadlines, and thresholds.

Rather than ask every requester which of a dozen state laws they think applies to them, Blankitt Privacy applies the strictest common denominator, which in practice is California:

• Its 45 day deadline is as tight or tighter than the other states' initial windows.
• Its set of consumer rights covers what the other state laws grant.
• Honouring an appeal (which some states mandate and California handles via re-request) satisfies the strictest appeal requirements.

If you satisfy a Californian, you've satisfied a Virginian.

What it means for you

• You don't need to determine the requester's state. Handling every US request to the California standard is compliant everywhere and simpler to operate.
• You may be more generous than legally required. Most state laws only apply above business-size thresholds, and only to residents of that state. Answering anyway costs you the same workflow you already run.
• The refusal and appeal flow already speaks US. Refusal emails to US requesters describe the appeal right, and upheld appeals mention escalation to the state Attorney General.

If your legal team wants a different posture for US requests (for example, only servicing states where you meet the thresholds), that's a policy decision to record in your privacy notice. The workflow in Blankitt Privacy stays the same.